diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2018-01-25 18:36:35 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-01-29 12:02:54 -0500 |
| commit | 9fb582b67072bea6cbfe1aefc2be13c62c7681bf (patch) | |
| tree | c2be3e6f9bc8cde4512dbb7871fcc5801c9f45c2 /include/linux/skb_array.h | |
| parent | 84328342a70a44379dd73011a44c5f5e00481a42 (diff) | |
Revert "net: ptr_ring: otherwise safe empty checks can overrun array bounds"
This reverts commit bcecb4bbf88aa03171c30652bca761cf27755a6b.
If we try to allocate an extra entry as the above commit did, and when
the requested size is UINT_MAX, addition overflows causing zero size to
be passed to kmalloc().
kmalloc then returns ZERO_SIZE_PTR with a subsequent crash.
Reported-by: syzbot+87678bcf753b44c39b67@syzkaller.appspotmail.com
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/skb_array.h')
0 files changed, 0 insertions, 0 deletions